From cbbaea91483911556a542a75792efb00673e1c3b Mon Sep 17 00:00:00 2001
From: DCCONSTRUCTIONS <dcconstructions@MacBook-Pro-DCCONSTRUCTIONS-2.local>
Date: Sun, 23 Aug 2026 20:21:43 +0300
Subject: [PATCH] accept empty Docker port bindings in M4.7 preflight

---
 scripts/Invoke-M47CanonicalGraphShadow.ps1     | 8 ++++++--
 tests/test_m47_worker_graph_shadow_artifact.py | 2 ++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/scripts/Invoke-M47CanonicalGraphShadow.ps1 b/scripts/Invoke-M47CanonicalGraphShadow.ps1
index 4bef1b3..b07b3cf 100644
--- a/scripts/Invoke-M47CanonicalGraphShadow.ps1
+++ b/scripts/Invoke-M47CanonicalGraphShadow.ps1
@@ -136,6 +136,10 @@ function Write-Utf8NoBom([string]$Path, [string]$Value) {
     [IO.File]::WriteAllText($Path, $Value, $encoding)
 }
 
+function Test-NoPublishedPorts([object]$Container) {
+    return @($Container.HostConfig.PortBindings.PSObject.Properties).Count -eq 0
+}
+
 if ($env:COMPUTERNAME -cne "DESKTOP-OPJ8J04") {
     throw "M4.7 shadow release is pinned to DESKTOP-OPJ8J04"
 }
@@ -388,7 +392,7 @@ try {
         $tritonCandidate.Id -cne $tritonCandidateId -or
         $tritonCandidate.Image -cne $descriptor.container.image_id -or
         -not $tritonCandidate.HostConfig.ReadonlyRootfs -or
-        $null -ne $tritonCandidate.HostConfig.PortBindings
+        -not (Test-NoPublishedPorts $tritonCandidate)
     ) {
         throw "M4.7 isolated Triton contract changed"
     }
@@ -407,7 +411,7 @@ try {
             $candidate.Image -cne $descriptor.container.image_id -or
             $candidate.HostConfig.NetworkMode -cne ("container:{0}" -f $tritonCandidate.Id) -or
             -not $candidate.HostConfig.ReadonlyRootfs -or
-            $null -ne $candidate.HostConfig.PortBindings
+            -not (Test-NoPublishedPorts $candidate)
         ) {
             throw "M4.7 graph candidate isolation contract changed"
         }
diff --git a/tests/test_m47_worker_graph_shadow_artifact.py b/tests/test_m47_worker_graph_shadow_artifact.py
index d90f3d0..754f7de 100644
--- a/tests/test_m47_worker_graph_shadow_artifact.py
+++ b/tests/test_m47_worker_graph_shadow_artifact.py
@@ -132,3 +132,5 @@ def test_m47_runner_calls_only_the_canonical_graph_entrypoint() -> None:
     assert 'Write-Output "DURABLE_WORKER_ACTION=none"' in runner
     assert 'Write-Output "HISTORICAL_TRITON_ACTION=none"' in runner
     assert 'Write-Output "ISOLATED_TRITON_ACTION=removed"' in runner
+    assert "function Test-NoPublishedPorts" in runner
+    assert "PortBindings.PSObject.Properties" in runner